Three RF channels. One fused picture.
TrailSense is not magic. It is a logarithmic RF power detector feeding our proprietary detection engine. This page explains, with no marketing fluff, exactly what each piece does and what it cannot do.
Analog RF burst detection.
The AD8317 is a logarithmic RF power detector with a 60 dB dynamic range from -55 dBm to 0 dBm. We pair it with a Ultra Low-Noise Amplifier (~20 dB gain, 20-4000 MHz pass-band) so it can pick up faint transmissions from across a property.
It outputs a DC voltage proportional to total RF energy in its input bandwidth. It samples that voltage at 1 kHz, tracks the noise floor, and flags a burst when energy crosses the noise floor by 10 dB or more for at least three consecutive samples.
What this gets you: the unit detects active RF transmissions in the 20-4000 MHz range - which covers most cellular uplink bands and the 2.4 GHz ISM band. What it does not get you: which carrier, which protocol, which device, or any other identifying or personal information of the cell phone.
802.11 management-frame capture.
The WiFi radio runs in promiscuous mode and captures probe requests and beacons broadcast by every WiFi-enabled device in range. Each frame yields a source MAC, an RSSI, and a set of 802.11 information elements (IEs) describing the device's hardware capabilities.
Modern phones randomize their MAC for privacy. Our detection engine works around this by hashing the IE fields - supported rates, HT/VHT/HE capabilities - which do not change when the MAC rotates. The fingerprint is the same; only the address has changed.
Note: this channel is 2.4 GHz only. The WiFi radio does not channel-hop into the 5 GHz UNII band. If a device is 5 GHz only, we will not see it on this channel.
Passive advertisement scanning.
The BLE GAP scanner reads advertisements from every BLE device in range. Each advertisement yields the advertiser address, address type, RSSI, manufacturer data, device name, and timing.
We classify each detection by phone-likeness. Apple- and Google-style manufacturer data, RPA/NRPA address types, and 100-1500 ms advertising intervals are strong phone signals. Beacons, fitness trackers, and IoT noise are downweighted.
BLE is short-range by physics, so this channel mostly catches devices that come close to a unit - someone walking past, an AirTag in a vehicle, a phone in a pocket. The signal strength is what powers our cross-modal correlation: when a BLE detection and a WiFi detection track each other in time and RSSI, the engine merges them into a single device.
From three streams to one device count.
Three radios produce three independent streams of noisy evidence. Our detection engine resolves that evidence into a single, conservative count of unique devices on the property. It runs on the Meerkat in fixed-point math - no GPU, no cloud, no floats.
IE fingerprinting
When a device randomizes its MAC, its hardware capabilities don't change. We hash 802.11 IEs (supported rates, HT, VHT, HE) into a fingerprint that survives MAC rotation. One phone reads as one device, not twelve.
Burst-timing signatures
Two devices with identical IE fingerprints get separated by inter-probe timing. We track the mean and variance of probe intervals using Welford's online algorithm and split fingerprints whose timing patterns diverge.
Phantom-MAC suppression
When two MACs share the same IE fingerprint, peak RSSI within 10 dB, overlapping detection windows, and burst timing within 20 percent, they are declared phantoms of one device and merged.
Cross-modal correlation
WiFi MAC and BLE address linked into one device when their RSSIs track within 12 dB and detection times overlap within 12 seconds. Confidence threshold: 60 percent. Below that, they stay separate.
Persistence pool
A pool of recent fingerprints persists across detection windows so the same device isn't re-counted as new every cycle. LRU eviction when the pool fills.
Conservative undercounting
When confidence drops below 50 percent, we reduce the final estimate. Property owners would rather see a confident 5 than a guessing 12. Honest under-counts beat brave over-counts.
Passive only. No content. No identity.
The detection unit never transmits a probe of its own. It cannot intercept calls, messages, or data; the Meerkat has no demodulator and the WiFi/BLE radios run in passive mode. We log fingerprints and signal strengths, not identities. Monitoring publicly broadcast RF on your own property is legal in the U.S., but specific use cases - especially commercial or government - should be reviewed against local statute. We are not your lawyer.
Read the spec sheet.
Hardware, sensitivity, backhaul, deployment options.
See the product